What changes for you in FosterStack Cache v0.3.0

You run FosterStack Cache for Gradle or Maven builds and you want to know what an upgrade to v0.3.0 changes. Three things may matter on your side: check them before you upgrade.

DRAFT for v0.3, private preview, not published and never merged before v0.3.0 is live.

Check these before you upgrade

• Linux only. v0.3.0 ships Linux archives (amd64 and arm64) and no macOS archive. On a Mac, run the Linux container image under Docker Desktop.
• No -debug image. v0.3.0 ships the production and fips images only. They hold only the fscache binary, with no shell, so look inside a running container from outside it with kubectl debug or docker debug; the README has a section on it.
• Inside the data folder. The data folder path is the same, but temporary files of writes in flight now live in a +tmp folder inside it.

What stays the same

The Gradle and Maven protocols stay as they are, and every FSCACHE_* setting you use today keeps its meaning. Two new optional settings, FSCACHE_TLS_CERT and FSCACHE_TLS_KEY, make the server itself serve HTTPS (TLS 1.2 or later); set both or neither. The server now binds its address first and logs a warning for an FSCACHE_* variable it does not know. A request with more than 500 header values has been rejected with 431 (Request Header Fields Too Large) since 0.2.2, because of Go 1.27; Gradle and Maven send far fewer.

Kept patched

We keep FosterStack Cache patched. The server does not update itself, so watch the repository's releases on GitHub. Our target for vulnerable dependencies is 48 hours from disclosure; the scope is in SECURITY.md.

How the release is built

Signed at every stage, verified together at release. The image is built from signed packages, with no base image. We secure our own release pipeline first. You can check all of it yourself: see verify a release yourself and how we build.

Upgrading

The upgrade steps are the same as for any release: pull the new tag and start it on the same volume. See upgrading from 0.2.x to v0.3.0 for what to check first.

Related: changelog and security policy.

Moving off the free Build Cache Node? See what the end of life means and the migration guide.